WordPress Mesmerize Theme <= 1.6.120 is vulnerable to Cross Site Request Forgery (CSRF)

Software Mesmerize Type Theme Vulnerable versions = 1.6.120 Fixed in 1.6.124 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37431 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c60ba7d94aaa Credits Dhabaleshwar Das...

CVE-2024-3494 Mesmerize Companion <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode

The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerizecontactform' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-3494

The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerizecontactform' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-3494

CVE-2024-3494 concerns the Mesmerize Companion WordPress plugin. It enables Stored XSS via the mesmerize_contact_form shortcode in all versions up to 1.6.148, caused by insufficient input sanitization and output escaping on user-supplied shortcode attributes. The vulnerability permits an authenti...

WordPress Mesmerize Companion plugin <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mesmerizecontactform Shortcode vulnerability discovered by stealthcopter in WordPress Plugin Mesmerize Companion versions = 1.6.148...

PT-2024-26260 · WordPress · Mesmerize Companion

Name of the Vulnerable Software and Affected Versions: Mesmerize Companion plugin for WordPress versions up to, and including, 1.6.148 Description: The issue is related to Stored Cross-Site Scripting via the plugin's mesmerize contact form shortcode due to insufficient input sanitization and outp...

WordPress plugin Mesmerize Companion 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

WordPress Mesmerize Companion Plugin <= 1.6.148 is vulnerable to Cross Site Scripting (XSS)

Software Mesmerize Companion Type Plugin Vulnerable versions = 1.6.148 Fixed in 1.6.149 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3494 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a79965937956 Credits stealthcopter...

Mesmerize Companion < 1.6.149 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode

Description The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerizecontactform' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

CVE-2019-25142

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 Mesmerize and 1.0.172 Materialis. This is due to 'companiondisablepopup' function only checking the nonce while sending user input to the 'updateoption' function...

CVE-2019-25142

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 Mesmerize and 1.0.172 Materialis. This is due to 'companiondisablepopup' function only checking the nonce while sending user input to the 'updateoption' function...

CVE-2019-25142

The Mesmerize (up to 1.6.89) and Materialis (up to 1.0.172) WordPress themes are vulnerable to authenticated options changes due to companion_disable_popup not fully validating input before update_option. This allows authenticated attackers to modify restricted options. Remediation: upgrade Mesme...

WordPress theme Mesmerize & Materialis 安全漏洞

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on PHP and MySQL servers.WordPress theme is a theme for WordPress. A security vulnerability exists in the WordPress theme Mesmerize & Materialis, which stems from the fact that...

PT-2023-11369 · Unknown +1 · Materialis +1

Name of the Vulnerable Software and Affected Versions: Mesmerize versions up to, and including, 1.6.89 Materialis versions up to, and including, 1.0.172 Description: The issue allows authenticated attackers to change restricted options due to the companion disable popup function only checking the...

CVE-2022-4481

The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

Cross site scripting

The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4481 Mesmerize Companion < 1.6.135 - Contributor+ Stored XSS

The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4481

The CVE-2022-4481 entry affects the Mesmerize Companion WordPress plugin prior to version 1.6.135. The vulnerability arises because the plugin does not validate and escape certain shortcode attributes before output, enabling Stored XSS. Impact can allow users with as low as Contributor privileges...

CVE-2022-4481 Mesmerize Companion < 1.6.135 - Contributor+ Stored XSS

The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

WordPress plugin Mesmerize Companion 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability in the...